Metamask should have better safety features by now, it is self-custodial, however, in the event of a wallet being compromised and unauthorized access to the user' log in occurs (for example to a third party application like staking or farming) Metamask just denies any responsability about it as it happened to someone I know.